NSSM (Non-Sucking Service Manager) is a legitimate Windows tool that attackers abuse to run malicious executables as persistent services. In a real incident, attackers used NSSM to keep ngrok running as a service, creating a stealthy backdoor for tunneling RDP/VNC traffic. Key hunting techniques include checking Event ID 7045 for unexpected NSSM service installations, inspecting the Registry Parameters subkey (not just ImagePath) to find the real executable, and analyzing live process command lines with Process Explorer or Velociraptor. The Parameters subkey is critical because the top-level ImagePath only shows nssm.exe, hiding the actual payload.
48 Impressions